9bcf0ee5b22c6e5967609d0d7441ed38 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9bcf0ee5b22c6e5967609d0d7441ed38
Size

88KB
MD5

9bcf0ee5b22c6e5967609d0d7441ed38
SHA1

2e2795cf1879be9148983d2907c5c85fb434fe50
SHA256

4bcd15a2469fa1a0db3a59150579508738be2733fb3f4e2cab90945a1a248cef
SHA512

a99d05eff8863f4b249f37bcf55e4557898a433ee23518f262ce1491ed8ca31c91b65e9faeac3cfded45e7c2210e80808a52f7f6f38da8db9d23dfa2eaf5a0b9
SSDEEP

1536:mzy+lUFl01sLz35oXXpPmBwgPHacDFy4uLqdnZV:mzyWUFK143SXW9PHNueVZV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9bcf0ee5b22c6e5967609d0d7441ed38

Files

9bcf0ee5b22c6e5967609d0d7441ed38
.exe windows:4 windows x86 arch:x86

8b4f4a5557fb1110778d74f9ebc7f94c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
DeleteCriticalSection
ReleaseMutex
FreeConsole
GetComputerNameA
GetLastError
Sleep
GetDiskFreeSpaceExW
GetDriveTypeA
GetModuleHandleA
IsBadReadPtr
EnumResourceTypesA
TlsGetValue
GetTickCount
LoadLibraryExA
IsBadCodePtr
VirtualProtect
GetCommandLineA
FindClose
SetLastError

shell32

ShellMessageBoxA
SHGetMalloc
SHGetSettings
DragQueryFileA
ExtractIconA
SHGetDiskFreeSpaceA
SHFree
DllUnregisterServer
StrChrA
DuplicateIcon
DragFinish
DragAcceptFiles
ShellAboutA

printui

PnPInterface
vPrinterPropPages
vQueueCreate
bPrinterSetup
bFolderGetPrinter

advapi32

RegCloseKey

Sections

.text
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE